Chainalysis: North Korean and Iranian Hackers Drive 420% Surge in On-Chain Malware Writes

According to Cointelegraph, a Chainalysis report shows a 420% surge in the frequency of attackers storing malware instructions or infrastructure information on public blockchains over the past 12 months, with state-backed hackers contributing about two-thirds of new activity each quarter. Chainalysis linked previously unattributed activity on Tron, Aptos, and BNB Smart Chain to the North Korean-affiliated group UNC5342.

The report notes that encoded pointers in Tron and Aptos transactions direct infected devices to the same BSC transaction, which contains encrypted server addresses and configuration data used to connect to remote access and data exfiltration infrastructure. Information on public blockchains remains accessible after domains, servers, or code repositories are taken down, enhancing the persistence of malware activity. In 2025, North Korean hackers used a similar technique, EtherHiding, to embed coin-stealing code in smart contracts.

Additionally, malicious blockchain writes have grown 440% since July 2025, when high-capacity open-source Chinese AI models began gaining the ability to generate malicious code. Eric Jardine, head of cybercrime research at Chainalysis, said a clear temporal correlation was identified, but there is no proof that attackers used these models.

Chainalysis also identified suspected threat actors linked to Iran's Ministry of Intelligence, who write encoded command-and-control routing data to the Bitcoin blockchain and send small payments to a well-known address historically associated with Satoshi Nakamoto, which is unrelated to the attackers and serves only as a permanent public location for infected devices to fetch update instructions.